The CRA was initially proposed over two years ago with the aim of strengthening the security of various connected devices, including smartwatches, internet-enabled toys, and app-controlled home appliances. The rapid growth of such devices has raised concerns about increasing hacking risks, highlighted by reports of compromised baby monitors and children’s toys. The legislation seeks to shift the focus from profits to consumer security.
Under the new rules, products with digital components must adhere to mandatory cybersecurity standards throughout their lifecycle, from design and development to ongoing operation. This responsibility extends to distributors and retailers, who must ensure that the items they sell meet the EU’s stringent guidelines.
The CRA applies broadly to connected devices, which include any product that can connect directly or indirectly to another device or network. Certain categories, such as medical devices, automobiles, and some open-source software, are exempt as they fall under other regulatory frameworks.
Devices that meet the CRA’s standards can display the EU’s CE marking, signaling compliance with the new rules. This mark aims to make it easier for consumers to identify secure products without needing to conduct extensive research.
The EU has emphasized the importance of shifting cybersecurity responsibility to manufacturers. Companies must ensure their products meet the established standards to gain access to the EU market.
Enforcement of the CRA will be managed by oversight bodies within EU Member States, which will conduct compliance checks. Non-compliance with critical cybersecurity requirements can result in significant penalties, including fines of up to 2.5% of a company’s global annual revenue or €15 million, whichever is higher. Lesser violations carry fines of up to 2% of annual revenue or €10 million, and failure to cooperate with regulatory requests can result in fines of up to 1% or €5 million.
The CRA is a major step toward bolstering consumer protection in the increasingly interconnected digital landscape, placing greater accountability on manufacturers to prioritize cybersecurity.
